Evan Schuman's StorefrontBacktalk

The problem isn't near field communications (NFC) itself. Apple could easily stick the hardware into the next iPhone, just as Samsung put an NFC controller and security hardware in its Nexus S Android-based phone. But Apple is worried that there's no industry-standard way for apps to communicate with that hardware, which is also why the Nexus S can't currently behave like a Visa PayWave or MasterCard PayPass card, either. Once Google updates Android to add a software stack that can do payments, the process of hashing out that standard can begin in earnest.Read more...

After the RFPs are evaluated through simple "count the number of Yes answers" and other sophisticated techniques, a select few will get the full questioning and even fewer will get to do demos and participate in a trial. As long as no one holds vendors to the answers their teams originally gave (and who even bothers to check?), the incentive to be truthful in an RFP is nil.Read more...

The move, which hit at least one of the delisted vendors on January 31, is part of PCI's effort to create a proverbial level playing field. There are good and bad sides to this effort. The good is that it's noble in intent. It acknowledges that mobile payments have so many crucial differences from earlier payment methods that merely tweaking today's guidelines won't work. And it also notes that it would be unfair to let vendors that happened to have already been approved be the only applications with the seal of approval, as the door slamming on everyone else. The bad is that it's seeking the perfect at the expense of the good.Read more...

"Using an encrypting reader is not as simple as plugging it in. Very few POS processing systems can handle encrypted data. The vast majority of card data is processed as clear text ASCII. That includes the data read by most VeriFone terminals," said Tom Siegler, VP of Strategic Market Development at UIC USA, another vendor in the payment space. "The reader must be key-injected by a certified vendor with the key for the acquiring processor. This typically costs from $15 to $40. Some vendors want to gate the transaction and charge a fee for the service. This was VeriFone's and MagTek's business model. All encrypted transactions would generate revenue. Nice business, if you can get it."Read more...

Retailers looking to leverage social media are quickly learning that it’s a powerful tool—and it’s sometimes far too powerful. That’s a lesson Groupon learned in January, when it tried launching a new service in Japan. For those who need another reminder, a 16-year-old girl in Australia is only too happy to oblige. Seems that the girl posted an invite to her 16th birthday party on Facebook (with her address) and didn’t properly set the privacy settings.

It went viral, and almost 200,000 people said they would show up at her house. The party was canceled (which is a shame, given that the family apparently didn’t calculate the potential eBay revenue from selling all of those gifts), but it’s a critical reminder for retail. If a promotion goes viral, what seemed like a great idea can quickly morph into a disaster. Think Sorcerer’s Apprentice: social media is the magic spell and your impressively unhappy customers are the water. And those angry customers—facing hand-scribbled out of stock signs, huge lines and terrible customer service— will likely not forget. They won’t be bringing gifts, either.…

Why delay? Consider the Veterans Administration's data breach, which involved the theft of a laptop computer containing millions of records pertaining to veterans. The VA, upon learning of the theft from a contractor, notified all of the affected individuals, at a cost of millions of dollars. A few weeks later, the VA recovered the stolen laptop intact and discovered that no VA records had actually been touched. A delayed response in that case would have not only saved money but also prevented what turned out to be needless worry.Read more...

Remember when online commerce was going to cut out the middleman? Those days are long gone. On Tuesday (March 15) a Chicago-based shopping portal called BayRu, which allows Russian customers to buy from U.S. E-tailers, cut a deal to let shoppers pay for those U.S. goods in local currency at 500,000 locations throughout Russia using cash, credit cards, mobile payments and Western Union. The system works much like the Singaporean shopping portal that Google mistook for an Overstock.com link farm last month: Customers pick out goods online, and BayRu handles shipping and customs—for a fee.

How much does the middleman take? Items from three dozen E-tailers that include Macy’s, Target, Wal-Mart, Best Buy, Gap, Tiffany and ToysRUs—oh, and Overstock.com, too—require manual intervention for pricing, so the markup varies. A $7.99 paperback from Amazon, for example, costs a Russian customer the equivalent of a modest $9.10. But a $725 iPad 2 (an eBay “Buy it now” item) is marked up to a breathtaking $1,025. That’s money major retailers will keep leaving on the table until they figure out how to handle global customers—and global payments.…

Both debuted at this week's South by Southwest Interactive show in Austin, Texas. The Amex trial was with Foursquare, and it let consumers associate their American Express card with Foursquare and then use that check-in service to get automatic discounts through mobile devices. Sounds good and mobile, no? Not at all. Turns out that the program requires consumers to use their rectangular mag-striped plastic for each purchase. In short, both Foursquare and mobile were solely decorative. Amex could have accomplished the same thing by issuing a news release and putting up posters announcing that its card users could get instant rebates at select retailers.Read more...

When you’re the largest company in the world, you can get away with a lot. There simply aren’t that many companies that could support a key retail strategy almost seven years after most of its rivals and get away with branding it as new. And yet, Wal-Mart did just that with its March 10 rollout of Pick Up Today, which is the chain’s name for Buy-Online-Pick-Up-In-Store. Remember when Best Buy and others did that in 2004?

How does one possibly admit to being almost seven years late to this key merged channel effort? Walmart.com GM Steve Nave did it in style: “Walmart is uniquely positioned to combine the power of E-Commerce with our national retail footprint to offer a leading, multichannel experience that delivers the best savings and convenience to our customers.” The move is a good one and well overdue, but come on. At least address the fact that you’re so very late. Then again, in retail, if Wal-Mart hasn’t done it yet, then maybe it hasn’t really been done? …

"If you think about mobility, interesting applications tend to leverage three things: presence; authentication; and location. Presence: Are you there? Are you on the network? Are you live? Can somebody see you? Location: Where are you physically? And to what level of granularity can you see that? Authentication: Are you who you say you are?" Sajor said. "Those are the three crown jewels. You can't do much interesting unless you have those three things locked in to some degree or another."Read more...

But it took 25 years (most of which Woodland worked for IBM, which wasn't much interested in the invention) for optical scanning technology to catch up so the idea could be adopted as UPC codes in 1974. And even though barcodes were on their way to becoming the most important technology in retail, by 1976 BusinessWeek pronounced it a failure. Analysts had predicted 1,000 stores would have scanners by then, but only 50 did. Clearly, barcodes were a flop. A decade later they were everywhere.Read more...

VeriFone did this all to attack a much smaller rival called Square, which it repeatedly identified by name. The ironies continue. VeriFone posted a special page for this content, including a domain name referencing its rival, Square: http://www.sq-skim.com/. A key part of that page was a YouTube icon that would play the video. But YouTube quickly took down the video, breaking the link.Read more...

Lack of training, coupled with little or no signage and marketing support, will be the silent killer of many in-store retail mobile efforts. For example, Starbucks' mobile payment scheme remains invisible in some stores, where associates still don't know how to use the scanners that read payment codes off customers' mobile phone screens. And Shopkick is in many retail locations where there's no signage about Shopkick and the associates don't even know what it is.Read more...

Still, are the extreme bandwidth and related demands of streaming video going to end up undermining more strategic network functions, such as selling stuff? Pizza Hut CIO Baron Concors was afraid that it might indeed do that. He still went ahead with video. But he wanted a third party—one that would keep these bandwidth-breaking B-movies far away from his pizza-selling sites—involved. "I was not interested in undertaking the effort to build out a YouTube-like infrastructure, along with the concerns about bandwidth, security and site performance," Concors said.Read more...

The patent itself is fairly straightforward, in that the system assumes software will activate the group of cards by scanning (or keying in) the first card number, along with the number of cards sought. The patent spoke of variations of this approach: "The point-of-sale device can request a confirmation of the last number in the pack of cards. Thus the clerk can either swipe or hand key in the number of the last card that makes up the pack of cards," the patent filing said.Read more...

Google has reached into users' mobile devices at least once before to delete apps in the name of security. Most users may not mind—certainly not as much as, say, Amazon reaching into their Kindles to delete mistakenly published e-books. But for retailers that want to use an Android device as a point-of-sale unit, the ability of a vendor—or any outsider—to modify the device by long distance could make getting a QSA's approval impossible.Read more...

But the trick is not—in this case—getting people to use this feature. It's getting them to use the mobile device itself for commonplace functions. It's also waiting a year or so to see if this scan convenience exposes security issues, such as the one last year involving Walgreens and chat transcripts. Will those scans be encrypted and protected as aggressively as the older methods? As new methods are tried, extra effort must be applied to anticipate new data breach attack methods.Read more...

Increasingly, retailers are looking at mobile payment systems that do not require their own dedicated infrastructure. Using ubiquitous handheld devices over regular Internet connections, these devices are cheap, easy to maintain and hold great promise for line-busting, inventory management, offsite purchases and a host of applications we haven't even thought of. An example of such a device is the "square" payment system. This small cube-shaped device plugs into any iPhone's audio plug and, with the downloadable software and a square processing account, allows anyone to process credit cards.Read more...

Achieving PCI compliance in a cloud-based environment will involve some intense negotiations between the merchant and its cloud provider. If a merchant is neither willing nor able to dig into the details and maybe do a little arm wrestling with its provider, moving a payment application to the cloud is not for that merchant. Negotiating a detailed, comprehensive service level agreement (SLA) will be perhaps the most important single step to achieving PCI compliance in the cloud. But before you can even begin to develop an SLA, a merchant needs to understand who does what. That is, the first thing you need to know is which services will be provided by the cloud provider and which are the merchant's responsibility.Read more...

The video of the execution released by the killers showed just a little of the skin of the arm of the executioner. Authorities then matched a "bulging vein" in his hand with that of the suspect in custody. Some question the accuracy of vein patterns in a retail application, but NEC argues authentication that combines a vein scan and a contactless fingerprint scan may prove to be difficult to fool.Read more...

The Inside Secure OpenNFC standard can allow third parties to access NFC capabilities on phones, effectively bypassing mobile-operator-led initiatives such as Isis. Asks Columnist Nick Holland: Is it too late for the Isis consortium to change direction and work in conjunction with existing card networks such as Visa and MasterCard?Read more...

The move itself certainly made sense. The retailer tried moving non-customer traffic—such as search engine bots and agents trying to track a variety of Web performance elements—to some slightly slower servers, with the intent of making the experience much faster for paying customers. And if a bot for Bing, Yahoo or Google get its data a little bit more slowly, no harm done. That was the theory. But slowing down performance for a Google spider, for instance, will in turn cause Google to assume your site is slower and that could impact a retailer's ranking on the search giant. It also caused some companies that track—and report publicly—Web performance to see the retailer's Web presence as slow or, in this case, down completely.Read more...

"The carriers know something about you. They authenticate you, and it's reasonably difficult to falsify or spoof that authentication. If you're holding that device, there's a pretty darn good chance that you are who you say you are, as you've authenticated with the mobile network," said Sajor, who was recently promoted to CIO from Chief Technology Officer. "Wouldn't it be interesting, wouldn't it be nice to use that authentication to authenticate you for your mobile experience all the way through the entire mobile payment channel? That would take away the logins and all of that kind of thing. You'd probably want to have some secondary protection: PINs or whatever. But if you could actually use that authentication in a sensible way to seamlessly permeate the entire experience, now you get a much more holistic experience based on what the carrier already knows. The data is already there. We just have to be able to get to it. I don't think we're quite at that point yet." But Pizza Hut's CIO urges caution until the U.S. cleans up mobile standards.Read more...

Their consensus: The First Phone works, but it still has a long way to go. That's what you'd expect from a first try at a mobile POS device, though, and that first draft won't get better without lots of listening on the part of IT. The comments of the Home Depot associates go a long way to point out the challenges mobile POS faces as it rolls out at Home Depot, Nordstrom and other retailers.Read more...

According to a statement from Overstock CEO Patrick Byrne, one reason Google suspected Overstock of link farming was the E-tailer's program that offered discounts to university faculty and students. It turns out Google trusts .edu links more than others, and that program raised red flags. But a much bigger problem was probably Tarazz, the Singaporean Web site that created a mirror of Overstock's own site—complete with 3.5 million links to Overstock.Read more...